Summary
When calling the ChoosingRam.sol::increaseValuesOfParticipants function, the challenger and participant tokenID can be the same. This guarantees a victory for the caller of the function and their token.
Vulnerability Details
In the ChoosingRam.sol::increaseValuesOfParticipants function there are no checks to make sure that the challenger and participant tokenID aren't the same. This means that the caller of the function and their token will win the value increase 100% guaranteed.
function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
if (ramNFT.getCharacteristics(tokenIdOfChallenger).ram != msg.sender) {
revert ChoosingRam__CallerIsNotChallenger();
}
if (block.timestamp > 1728691200) {
revert ChoosingRam__TimeToBeLikeRamFinish();
}
Impact
The test below passes showing that the same tokenID can be used as the challenger and participant.
function test_challengerAndParticipantTokenIDCanBeTheSame() public {
vm.startPrank(player2);
ramNFT.mintRamNFT(player2);
choosingRam.increaseValuesOfParticipants(0, 0);
vm.stopPrank();
assertEq(ramNFT.tokenCounter(), 1);
assertEq(ramNFT.getCharacteristics(0).isJitaKrodhah, true);
}
Tools Used
--Foundry
Recommendations
It is recommended to add a check to make sure that the challenger and participant tokenID's are not the same.
+ error ChoosingRam__TokenIdOfChallengerAndParticipantCannotBeTheSame();
function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
+ if (tokenIdOfChallenger == tokenIdOfAnyPerticipent) {
+ revert ChoosingRam__TokenIdOfChallengerAndParticipantCannotBeTheSame();
+ }
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
if (ramNFT.getCharacteristics(tokenIdOfChallenger).ram != msg.sender) {
revert ChoosingRam__CallerIsNotChallenger();
}
if (block.timestamp > 1728691200) {
revert ChoosingRam__TimeToBeLikeRamFinish();
}
